CVE-2026-111923

7.5High

Published 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-674

Impact

Unauthenticated remote attackers can crash the Fleet server and cause a denial of service. They only need network access to send a 150-byte crafted binary plist payload to the Apple MDM enrollment endpoints.

Root cause

Unbounded recursion during Apple MDM enrollment property list parsing leads to infinite recursion and exponential CPU and memory allocation.

Affected systems

Fleet before 4.89.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade Fleet to version 4.89.0 or later. If upgrading must wait, block or restrict unauthenticated network access to Apple MDM enrollment endpoints at your reverse proxy or firewall.

shell

$ fleetctl version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111923